February 1993 - cypherpunks-legacy

March 13 cypherpunks meeting
by Eric Hughes 27 Feb '93

27 Feb '93

Announcing: The First Annual Post-CFP cypherpunks meeting. The next physical meeting of cypherpunks will be March 13, 1993, at the usual time, noon, in the usual place, Cygnus Support Offices. This is one day after CFP-93, the third Conference on Computers, Freedom, and Privacy. CFP is an increasingly important conference concerning an only slightly broader spectrum of privacy issues than are normally discussed on the cypherpunks list. At the first CFP conference I met David Chaum, who awakened a latent interest in cryptography. This awakening led indirectly to the formation of this list. There will be people from all over the country there. We have set the date of our meeting so that they could attend. We are, in fact, going to give out an open invitation there. I would urge all of you who have been considering making a trek to come to one of these meetings to do so this time. And while I do not expect Dorothy Denning to show up (although she would be welcome, if uncomfortable), I do expect some surprises. Please surprise me yourself. If you need a place to stay, ask on the list. I myself am already putting up some friends before the conference. For that matter, I would urge all of you to come to the conference itself. If you can't afford to go, just remember that while the sessions you have to pay for, the hotel bar you do not. A word to the wise is sufficient. Thank you all. Eric ----------------------------------------------------------------------------- MEETING Date: Saturday, 13 March 1993 Time: 12:00 noon Where: Cygnus Support Offices, Mt. View, California SCHEDULE Meeting 12-6 Dinner 7-? AGENDA We have Arthur Abraham's talk on hash functions left over from last time, which was interrupted by a photo shoot. Scott Collins intimated that he'd have more results on random numbers. With the opportunity given to have so many people there, I'd suggest that discussion of cryptographic infrastructure would be appropriate, together with a goal setting session. Please discuss this on the list. ----------------------------------------------------------------------------- DIRECTIONS Cygnus Support 1937 Landings Drive Mt. View, CA 94043 +1 415 903 1400 switchboard +1 415 903 1418 John Gilmore Take US 101 toward Mt. View. From San Francisco, it's about a 40-minute drive. Get off at the Rengstorff Ave/Amphitheatre Parkway exit. If you were heading south on 101, you curve around to the right, cross over the freeway, and get to a stoplight. If you were heading north on 101, you just come right off the exit to the stoplight. The light is the intersection of Amphitheatre and Charleston Rd. Take a right on Charleston; there's a right-turn-only lane. Follow Charleston for a short distance. You'll pass the Metaphor/Kaleida buildings on the right. At a clump of palm trees and a "Landmark Deli" sign, take a right into Landings Drive. At the end of the road, turn left into the complex with the big concrete "Landmark" sign. Follow the road past the deli til you are in front of the clock tower that rises out of one of the buildings, facing you. Enter through the doors immediately under the clock tower. They'll be open between noon and 1PM at least. (See below if you're late.) Once inside, take the stairs up, immediately to your right. At the top of the stairs, turn right past the treetops, and we'll be in 1937 on your left. The door is marked "Cygnus". If you are late and the door under the clock tower is locked, you can walk to the deli (which will be around the building on your left, as you face the door). Go through the gate in the fence to the right of the deli, and into the back lawns between the complex and the farm behind it. Walk forward and right around the buildings until you see a satellite dish in the lawn. Go up the stairs next to the dish, which are the back stairs into the Cygnus office space. We'll prop the door (or you can bang on it if we forget). Or, you can find the guard who's wandering around the complex, who knows there's a meeting happening and will let you in. They can be beeped at 965 5250, though you'll have trouble finding a phone. Don't forget to eat first, or bring food at noon! I recommend hitting the burrito place on Rengstorff (La Costen~a) at about 11:45. To get there, when you get off 101, take Rengstorff (toward the hills) rather than Amphitheatre (toward the bay). Follow it about ten blocks until the major intersection at Middlefield Road. La Costen~a is the store on your left at the corner. You can turn left into the narrow lane behind the store, which leads to a parking lot, and enter by the front door, which faces the intersection. To get to the meeting from there, just retrace your route on Rengstorff, go straight over the freeway, and turn right at the stoplight onto Charleston; see above. See you there! John Gilmore

1 0

Hellman and DES
by Dave Banisar 27 Feb '93

27 Feb '93

I've talked to Martin Hellman quite a few times (he came to my last crypto conference and gave an overview of the field), he has never said that he could crack true DES. When DES first came out, he was one of the people most actively opposing the 56 bit key as being too small. At the time, he estimated that a machine of parallel processors could be built for $10M that would crack DES keys easily. DES at the time was only supposed to be for 10 years and then a new system was supposed to replace it. Today, he advocates for security that you triple-DES your communications/files. At last word (and I may have missed any advancements in the flame wars on sci.crypt), Shamir and Biham had cracked up to 2^^46, thats still quite a ways computationally from 2^^56. Dave

1 0

Re: DES
by John.Nieder＠f33.n125.z1.FIDONET.ORG 27 Feb '93

27 Feb '93

* Reply to msg originally in Cypherpunks <INET> phiber(a)eff.org (Phiber Optik) writes: BK> Slow down. Firstly, DES encrypts a 64-bit block with a 56-bit key. BK> Are you talking about key lengths? Yes. BK> It was originally proposed to use a BK> 128-bit key space, alla IBM's LUCIFER. But they opted on the smaller BK> key, which fuels this NSA conspiracy theory. As was their reaction to Hellman's proposal for a 64-bit key and any other proposed out-of-house improvement at that time. BK> Saying that Hellman "broke" anything is a bit BK> strong. I remember reading a published paper, I believe by Hellman and BK> one other, describing that they were able to WEAKEN DES (with a smaller BK> key space for their experiment), using a statistical approach, and that BK> this could possibly be applied to the DES standard. I refer you to Warren on this. It was my understanding of the article that Hellman had actually decrypted DES cyphertext prepared with the then-proposed 54-bit key standard. BK> If you're not just some NSA-paranoid wacko, BK> reference some papers to back up your claims. Otherwise, you're just BK> another NSA-conspiracy theorist, and part of the noise. Please, there's no need for abuse here. I was referring to a published column by Jim Warren of the Electronic Frontiers Foundation in _MicroTimes_, a Bay Area computer paper. I do not know if you consider Warren or the EFF to be reputable. I assumed Warren's statements were factual. The assertion that Israeli intelligence made short work of DES was presented as I got it - an interesting rumor from someone who has been a fairly-reliable source of information in the past. BK> We're all BK> capable of suspecting underhandedness on the part of the NSA, but when BK> you start misrepresenting your opinions as fact, you're being BK> nonconstructive. I was merely relating published assertions by the EFF. If you believe these to be incorrect, then I'd advise you to take the issue up with Warren. I have no "opinion" in the matter, only suspicions. A great many people with academic background superior to mine also share these. My own background is in applied rather than theoretical security. I defer to academics in academic matters, but know that in matters of top security it is difficult to invest confidence in any mechanism as mired in continuing controversy as DES. That's all. JN ... "Oceania, 'tis for thee..." --- Blue Wave/Opus v2.12 [NR] -- John Nieder - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!John.Nieder INTERNET - John.Nieder(a)f33.n125.z1.FIDONET.ORG

1 0

What We Need to Censor
by tcmay＠netcom.com 27 Feb '93

27 Feb '93

I, too, am disturbed and worried by the abuses and politically incorrect postings being sent through anonymous remailers, so I support the calls by some on this list for censorship of various "bad" postings. Topics for banning: - hatred, such as the hatred some have for particular operating systems (unless the hatred is for DOS, which is justifiable, and hence acceptable). - advocacy of violence, which is why postings about Rambo movies and various porno movies (violence against women, don't you know?) need to be blocked by remailers. "Women Against Pornography" will be happy to instruct us on what media materials are acceptable and what are not. Jesse Helms, who is working closely with Andrea Dworkin and other feminists, will be happy to provide a list of banned topics. - this ban on advocating violence will also of course cover discussions of the Mideast, Bosnia, and the student uprisings in China several years ago (there was a lot of advocacy of violence then--can't have a repeat of that!). Let's all chant: "Hey Ho, Hi Ho, "rec.guns" has got to go." - ethnic slurs and advocacy of racial superiority (unless it involves the heartfelt calls for action by our oppressed African-American brothers and sisters, who have every right to call us honkies and advocate burning down our cities--we just can't tolerate those who call themselves "Aryan-Americans"). - advocacy of illegal acts, including nearly all postings to alt.drugs, alt.sex.children, talk.bizarre, and sci.crypt.underground. Come to think of it, perhaps those groups should just be shut down? - anonymous phone calls apparently are possible...perhaps we can require all phone calls go through government-cleared operators? And I have even heard that anonymous letters--even threats, blackmail (wonder where _that_ name came from?), pornography, and extortion demands--are possible using the U.S. mail system! How can this be? What can we do? I know, let's censor the mail system the same way we plan to censor the Net! So, you anarchists, let's implement these bans on what goes through remailers! One small problem: how can we do this when everyone's a remailer? When multiple routes exist? When sites are in many countries? Hmmmhhh...perhaps we censors just need to shut down the nets and stop all this loose talk. -Tim, applying for a job as a Usenet censor -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

2 1

Real World Kinda Guys Unite
by deltorto＠aol.com 27 Feb '93

27 Feb '93

>>Hal >> >>P.S. How about Deadbeat posting a public key? He keeps signing his >>messages but I can't check them. Yeah. How 'bout that, 'Beat? At _least_ we'd have the false security of being able to check your Pkey now and then... I feel full of Piss and Vinegar, so I'm volunteering to help get this WhistleBlowers thingus up and rolling. First, we need to disseminate PGP in it's various forms (UNIX, Amiga, Mac, DOS, etc) to some news agencies (e.g. TV stations, newspapers, radio like KQED, etc.). I need each person who represents a platform to send me a full package of PGP with Docs that I can have duped for mailing (for educational purposes only). No charge. We'll begin with a core group of media people and see how it goes. I have floated a few trial balloons and they're ready to bite. I suspect that we'll see it take off like a rocket, as Tim May suggested. All this discussion is truly fascinating, but if it doesn't get out into the real world it ain't worth the media it's magnetized on. I guess I'm just a real world kinda guy. 1. Let's get a reasonably friendly anon remailer process going for them. It *must* come with complete instructions for the hapless many. Get writing and send 'em to me. I am working on some simple instructions for MacPGP and will post an example as soon as I can get through all the damn mail in my various mboxes. (Overload!) 2. Let's hook some Govt. employees into it ASAP and really get this whistleblowing thing going. I want to stir up some mud at the bottom like Kelly suggests and I want it done NOW. 3. I need help from ALL of you to do this. I am beginning to compile a comprehensive list of Govt Officials from the White House on down thru the Congress to the Cabinet and the Joint Chiefs. This database will include their various addresses (USM and email), their many phone and fax numbers, and other pertinent info (party, salary, etc.). Anyone can have a copy when I finish it. I hope to make it fairly administration-independent so it will last and will probably set up a process on CompuServe so that public can send in updates as officials are un-appointed, die and/or are voted out of office, etc. 4. Eventually, we'll do an anonymous posting to a massive number of Govt sites inviting WBlowers to post to the list and inviting Press people to log on and download the dirt. I will be at the Modern Times bookstore event on March 7th in San Francisco if anyone wants to discuss this. I would also dearly like to attend CFP, but I haven't yet found a way to do it without money (anyone who knows a way I can volunteer my way in and help out please say so - I'll sweep up after, anything...). d2t

1 0

Re: more ideas on anonymity
by George A. Gleason 27 Feb '93

27 Feb '93

I agree with Jim that I may be treading a thin line on censorship, but consider the following: someone posts a series of inflammatory statements with the intent of stirring up trouble, attracts a following, and starts organising them for some kind of violence. Then one day along comes a message to start the race war or whatever. The next day there are a bunch of random acts of violence. Uh-oh... The point is that this is a broadcast medium, though without the limitations of conventional broadcast. I think we may end up facing these issues one way or another, sooner or later. Hopefully, LE can prevent violent acts by conventional means without resorting to limiting privacy. The thing is though, given the increasing cultural diversity in society and its resulting flattening of the normal curve of acceptable behavior, we're more and more going to be facing issues which are located in the depths of murky gray areas and in which we may find ourselves needing to tread fine lines, split hairs, and make all kinds of distinctions where there are no firm certainties. (run-on sentence alert!) -gg

1 0

Biham and Shamir on cracking DES
by Marc Horowitz 27 Feb '93

27 Feb '93

This is, I believe, the state of the art in published techniques to break DES. Note that this attack is basically useless against one-time or short-lived keys, since there's no chance to make repeated chosen plaintext attacks against the key. Short form: If you can get me to encrypt 2**37 plaintexts *of* *your* *choice* against my key, you can crack it. Marc This info is forwarded from a friend. Eli Biham and Adi Shamir, "Differential Cryptanalysis of the full 16-round DES," December 19, 1991. The paper was announced in Dec. '91 on the net, and paper copies circulated from people who had gotten copies directly from Biham & Shamir. The paper was submitted to Crypto '92 and presented there on August 20, 1992. The Crypto '92 proceedings will be published by Springer-Verlag at some point, so you could also reference it this way: {\sl E.~Biham and A.~Shamir}, Differential Cryptanalysis of the full 16-round DES, {\sl Advances in Cryptology: Proceedings of Crypto '92}, E.~Brickell, ed., {\sl Lecture Notes in Computer Science}, Springer-Verlag, New York, to appear. Biham is at Technion - Israel Inst. of Tech. Shamir is at Weizmann Inst. of Science. I don't know of an FTP site where the paper is available.

1 0

Re: DES
by hkhenson＠cup.portal.com 27 Feb '93

27 Feb '93

My take on breaking DES would be to just try all 2**56th keys on a massively parallel machine, though there may be better approaches. Keith

4 3

timestamps and signatures
by root＠rmsdell.ftl.fl.us 27 Feb '93

27 Feb '93

> ||use electronic ... public-key signatures, the kind that make it impossible > ||for one to deny having signed something. ^^^^^^^^^^^^^^^^^^ > ||^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > | Nice theory, but too simple. > | I can always deny signing something by claiming that my private key was > | compromised. I can even deliberately let it be known, if it's important > There's some very nice work by two people at Bell Labs (whose names I can't One of them is Stuart Haber (stuart(a)bellcore.com) > unforgeable digital timestamps. This is a much trickier problem than it firs > appears to be, but they have a nice solution. It's not too complicated. Basically, what you do is produce a hash of your text, and publish it widely in a medium that is being archived, and likely to be accessible and authenticable at a later time, for example by posting it in a classified ad in a large newspaper. Later, when verifying the timestamp one can get a copy of that newspaper from a library (or from several libraries, for greater security) and compare the published hash with that of the text. For greater efficiency, there's a simple way to combine a lot of messages and produce only one hash which is published. The information you get back and store as a part of the timestamp is enough to prove that this particular hash was one of the many combined to produce the published value. This system is actually operating, look in any Sunday New York Times in the Business Classifieds. > Given timestamps, we can then require that messages be not just > signed but dated. If my key becomes compromised, I revoke all > my signatures from some time on. By looking at the timestamp > that goes with the signature, we can determine whether it was > created before or after the compromise, and discard it if "after". Once can always claim that they "just found out" that their key has been compromised a year ago, and so deny having signed that signature. -- Yanek Martinson yanek(a)novavax.nova.edu

1 0

DES chips
by root＠rmsdell.ftl.fl.us 27 Feb '93

27 Feb '93

> Speaking of which, does anyone know who makes "the DES chip" (is > there more than one?)? I'd like to find a data sheet for it. There's no such thing as "the DES chip". "Since publishing the Data Encryption Standard, NBS has validated 45 (as of May 7, 1991) hardware and firmware implementations. Approximately three implementations are validated each year. The list of companies with validated chips is quite varied. It contains very small companies as well as many of the large U.S. electronics corporations. The implementations range from firmware programmable read-only memories (PROMs), which implement only the basic DES algorithm, to electronic chips that provide several different modes of operation running at speeds up to 45 million bits per second." ... "Hardware implementations of DES are widely available in the United States at prices under $100; DES encryption boards that can encrypt stored and transmitted data in a personal computer are available for under $1000; and stand-alone encryption units may be purchased for under $3000." (This is from "The Data Encryption Standard, Past and Future" by Miles Smid and Dennis Branstad, first appeared in Proceedings of the IEEE, vol. 76, no. 5, May 1988) I'm sure that since this was written the number of implementations has increased, the prices decreased, and the speeds increased. -- Yanek Martinson yanek(a)novavax.nova.edu

1 0